crowdsecurity/crowdsec · error

missing filter directive

Error message

missing filter directive

What it means

Validation failure in BucketFactory.compileExpr (reached via LoadBucket): the scenario specification has an empty filter directive, so there is no expression to evaluate for pouring events into the bucket. A warning 'Bucket without filter, abort.' is logged before returning.

Source

Thrown at pkg/leakybucket/manager_load.go:247

		}
		f.leakspeed = leakspeed
	}

	if f.Spec.Duration != "" {
		duration, err := time.ParseDuration(f.Spec.Duration)
		if err != nil {
			return fmt.Errorf("invalid duration '%s' in %s: %w", f.Spec.Duration, f.Filename, err)
		}
		f.duration = duration
	}

	return nil
}

func (f *BucketFactory) compileExpr() error {
	if f.Spec.Filter == "" {
		f.logger.Warning("Bucket without filter, abort.")
		return errors.New("missing filter directive")
	}

	runtimeFilter, err := compile(f.Spec.Filter, nil)
	if err != nil {
		return fmt.Errorf("invalid filter '%s' in %s: %w", f.Spec.Filter, f.Filename, err)
	}
	f.RunTimeFilter = runtimeFilter

	if f.Spec.GroupBy != "" {
		runtimeGroupBy, err := compile(f.Spec.GroupBy, nil)
		if err != nil {
			return fmt.Errorf("invalid groupby '%s' in %s: %w", f.Spec.GroupBy, f.Filename, err)
		}
		f.RunTimeGroupBy = runtimeGroupBy
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a valid `filter:` expr expression to the bucket spec
2. Verify templating renders a non-empty filter
3. If you truly want an always-match bucket, use a filter that evaluates to true, e.g. `filter: "evt.Meta.log_type != ''"`

Example fix

# before
name: x/empty
type: leaky
description: foo
# after
name: x/empty
type: leaky
description: foo
filter: "evt.Meta.log_type == 'http_access-log'"

if bucket.Spec.Filter == "" {
    return errors.New("scenario requires a non-empty filter expression")
}

When it happens

Trigger: Loading a bucket whose Spec.Filter is the empty string (missing `filter:` in YAML), during LoadBucket.

Common situations: Scenario YAML missing the filter key, template variables resolving to empty strings, or copying a bucket skeleton with the filter removed.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• invalid threshold: must be > 0 and <= 1
• capacity must be -1
• bucket must have name
• description is mandatory
• leaky failed :/

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8fc29cde5c6ca965. Report an issue: GitHub.